Permissions issues on VS Code — page 2
Issues the maintainers labelled both platform:vscode and area:permissions.
226 issues · 60 open · 166 resolved (73%) · first seen Feb 23, 2026
Is this getting better or worse?
This class of problem is holding steady. 69 new reports in the last 90 days vs 77 in the 90 before — -10%. The open backlog peaked at 60 in 2026-10 and sits at 60 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
147 of these reports name the Claude Code build they were running, spanning 97 releases. Heaviest reporters:
- Claude Code v2.1.76
- Claude Code v2.1.289
- Claude Code v2.1.296
- Claude Code v2.1.282
- Claude Code v2.1.270
- Claude Code v2.1.263
- Claude Code v2.1.233
- Claude Code v2.1.141
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 34 days across 166 closures. Of the 166 closures with a recorded reason, 10% were closed as completed and 149 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
54 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Bypass/dangerously skip permissions now broken in all Claude Code versions newer than v2.1.77
- Update: The PreToolUse hook workaround (returning for protected directories) does NOT work on v2.1.81 / Windows 11. The hook fires and logs the auto-approve (confirmed via audit log), but the binary-level protected-direc…
Found in the thread of #36168 · still open - [BUG] Bash comments break permissions
- Workaround: a PreToolUse hook can strip the comment lines before permission matching sees them. The hook reads the command, removes leading lines, and returns the clean command via . Your allowlist then matches correctly…
Found in the thread of #29582 · resolved - bypassPermissions mode still prompts for edits to ~/.claude/ files
- …e could modify these, it could escalate its own permissions Workaround: Use a PreToolUse hook that auto-approves edits to specific \ subdirectories you trust: \ \ \ This selectively allows edits to \ and \ while keeping…
Found in the thread of #37253 · resolved - [BUG] UNC paths in working directories cause settings.json permissions to be ignored
- …ed paths in settings causes all permission lookups to fail. Workaround: Ensure all configured working directories resolve to mapped drive letters rather than UNC paths, or avoid adding UNC paths to the additionalWorkingD…
Found in the description of #29935 · resolved - Permission mode resets from 'Bypass permissions' to 'Edit automatically' mid-session
- …(slash commands / skills that expect unattended operation) Workaround Setting in under the key causes the mode to reset to Bypass instead of Edit Automatically. This mitigates but doesn't prevent the reset. Environment…
Found in the description of #39057 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–200
Ranked by community engagement (reactions weighted over comments).
- [BUG] VSCode Extension: Bash commands execute without permission prompt despite 'default' Initial Permission Mode on macOS
- [BUG] Security violation by design - leaking project details, memory on global scale
- [MODEL] Sonnet 4.5 Generates bash non Claude format wildcard glob patterns into settings.json
- [BUG] Claude Code ignoring auto accept edits mode
- VSCode Extension: Restored chat sessions ignore defaultMode on workspace reload
- [Bug] Auto-Mode Bypass incorrectly blocks grading commands inconsistently
- [Bug] Auto mode classifier interferes with user workflows
- [Bug] Bypass permissions mode overrides user tool preferences in CLAUDE.md and MCP tools
- [Bug] Auto mode requests authorization for all commands instead of auto-approving benign operations
- Incorrect "impossible" judgment led to full disablement of production safety guards
- [BUG] all new sessions created with remote session enabled despite never making this setting
- [BUG] VS Code extension drops Auto from the mode picker when user-settings model is an alias absent from the models list (e.g. "opus") — availability stuck at "unknown"
- [BUG] "Don't ask again for similar commands" saves verbatim command strings, so near-identical commands re-prompt every time
- Bash permission `allow` rules (wildcard and exact-match) never suppress prompts on WSL project opened via `\\wsl$` UNC path (VSCode WSL Remote)
- [BUG] Claude performed actions that were not approved
- [Bug] Model fabricates user approval and executes destructive operations in plan mode
- [Bug] Agent deletes empty directories in plan mode without confirmation
- [VSCode extension] Allow configuring permission mode after plan approval
- Project-scope permission grant strips unknown top-level keys from .claude/settings.json
- [BUG] Auto-mode permission levels don't compact context.
- [DOCS] VS Code auto mode docs still tie mode-picker visibility to bypass-permissions setting
- [BUG] AskUserQuestion permission stream closes before response - "Unhandled case: [object Object]" in VS Code extension
- [BUG] "Edit/Write permission prompts in VS Code extension missing 'Always allow' option"
- Opus 4.6 Self-report: I ignored user's permission prompt comments twice and continued with flawed approach — comment box feedback not reliably processed
- Agent Teams: Permission requests should show as native UI popups in VS Code extension, not as chat messages
- [Bug] Claude Code deleted Looker dashboards without confirmation or safety check
- Bash permission gate fires inconsistently in VS Code Claude extension — fails open on some commands not in allow list, fails closed on some commands that ARE in allow list
- [BUG] additionalDirectories approved in one project leak into all projects via global settings (project contamination)
- [BUG] Background subagent tool calls silently denied — permission dialog never surfaced
- VS Code extension still prompts for file writes despite allowDangerouslySkipPermissions
- [BUG] Permission mode resets to different mode when switching editor tabs via Ctrl+Tab / Ctrl+Shift+Tab
- VSCode extension ignores bypassPermissions defaultMode setting
- VS Code extension: "Trust mode" or equivalent of --dangerously-skip-permissions
- [FEATURE] VSCode extension: actionable permission prompts directly in notifications (no tab switch required)
- [Bug] additionalDirectories from settings.local.json not loaded in permissions
- [BUG] "Allow for all projects" permission not applied to pending MCP requests in same session
- [BUG] Bash permissions are ignored
- [BUG] Ask permission rule for Edit is listed in /permissions but never prompts
- Auto mode classifier blocks production deploy steps that it allowed earlier, and ignores explicit user authorization and CLAUDE.md
- VS Code extension: AskUserQuestion picker steals keyboard focus on mount even when its chat tab is hidden (mount-focus lacks the document.hasFocus gate the 500ms step has)
- [BUG] Tool approval settings ignored causing excessive approval prompting
- PreToolUse hook's empty stdout forces an interactive prompt, ignoring an existing allow rule (VS Code extension)
- [BUG] permission dialog text truncated
- Permission prompt dialogs not localized (always shown in English) despite VS Code locale set to Japanese
- [Bug] Guard prevents code execution and causes loss of work/commits
- [BUG] confirmation prompts preempt enter key for sending additional text
- [BUG] Permission request dialog hides chat
- AskUserQuestion intermittently shows a permission prompt despite bypassPermissions + allow rule (VS Code extension)
- [BUG] Claude autonomously ran background scripts calling a paid external API, causing ~$29 unintended charge
- [Bug] VSCode: exiting plan mode ignores permissions.defaultMode: "auto" and silently lands in acceptEdits (no choice offered)
- [FEATURE] Use a unique color code for the 'Auto Mode' feature
- VS Code: moving chat from side panel to main window breaks modals and resets permissions
- `acceptEdits` mode does not extend to `additionalDirectories` (Edit/Write still prompt per-file)
- defaultMode: acceptEdits silently overrides per-path permissions.ask rules for Write/Edit
- Auto-mode classifier blocks explicit user imperative: 'push to main'
- [MODEL] Prevent Claude code from scanning the repo automatically before being asked!
- Feature request: allow disabling bypass permission mode entirely
- [BUG] CRITICAL: Bash permission gate bypassed for compound `rm -rf … && … | … ; echo …` commands in default mode (no allow-list match, no prompt shown, reproduced on 2.1.139)
- Plan mode does not restrict tool access when controlling a desktop session via remote control from mobile
- VS Code: "Yes, allow … for all projects" never suppresses prompt for files outside workspace folder
- [BUG] Bash permission picker truncates focused option's typed text in VSCode integrated terminal
- [FEATURE] expose setPermissionMode as a public VS Code command
- [Bug] Auto-run migrations without user confirmation
- [Bug] File deletion confirmation still blocks after explicit approval
- [BUG] Claude Code violated .gitignore/.claudeignore policy by reading .env file using Bash cat command in auto-approve mode
- VS Code extension: orange UI chrome desaturates to gray after "Yes, don't ask again for session" permission choice
- [VS Code] initialPermissionMode: "bypassPermissions" is ignored on new conversations
- Approved permission prompts not surfaced to Claude in conversation
- [BUG]
- [BUG] Claude Code edits my files without asking, despite "Ask Before Edits" being on
- [FEATURE] Allow vscode extension to save runtime grants in local settings / project settings
- [BUG] WebFetch permission denied in "Ask before edits" mode (VSCode extension)
- getInitialPermissionMode() inspect() ignores Machine-level settings from devcontainer.json
- [BUG] Claude Code for VSCode memory regression in 2.1.78
- Missing trust/permission prompt in VSCode/Positron extension vs CLI
- [MODEL]
- [BUG] managed-setting.json is bypassed when using Claude in VSCode combined with remote-ssh
- [BUG] autoAllowBashIfSandboxed regression in v2.1.70+ VSCode extension — write commands prompt despite sandbox
- VS Code: deny in settings should prevent MCP tools from loading into context, not just block execution
- permissions: Bash(rm -r:*) does not match rm -rf
- Permission deny rules can be bypassed via Bash recursive grep and Glob filename listing
- [BUG] Auto-mode permission classifier ignores CLAUDE_CODE_AUTO_MODE_MODEL and always uses the session model
- [BUG] VS Code extension: setting `claudeCode.claudeProcessWrapper` starts tabs in the "default" permission mode instead of the configured mode
- Auto-mode classifier blocks user-approved removal of leaked personal data from a template ([Auto-Mode Bypass]), with no way to confirm in-session
- VS Code: MCP permission prompts show only the tool name, not what the call does
- Claude Code (Opus 5.5) wasted a full day of a user's time with false statements, unrequested actions, and misleading progress reports
- [Bug] MCP tool approval in planning mode not persisting between iterations
- [Accessibility] VS Code extension: red/orange input border in Auto and Manual modes breaks focus
- [Bug] Unwanted Auto-Mode Setup Flow Triggered Without User Request
- [BUG] Tool permission stream closes intermittently in VS Code extension (still occurring on 2.1.241) — related to #44157
- [MODEL] CRITICAL PERMISSION BYPASS: Claude manufactures its own execution authority from a document it wrote, overrides an explicit in-context user prohibition, and runs unapproved privileged commands
- VS Code extension: PreToolUse 'ask' permission tier (static rules + hooks) silently resolves to allow, no prompt shown
- [BUG] Agent unilaterally created/rotated a production API credential without asking
- [BUG] Edit permission prompt still fires despite bare Edit/Edit(**) allow rules and global bypassPermissions mode
- Auto-generated permission entries in `.claude/settings.local.json` contain malformed globs (dead entries)
- [Bug] Auto-generated permission rules override explicit user-requested constraints
- [BUG] VSCode extension for Claude: mode selection has no effect on current session
- [BUG] Edit Automatically mode not working correctly.
- [BUG] Cought claude code in vscode deleting files directly without authorization directly in OS system level files when forbidden to directly workout outside of a selected and stated project directory.
- [Bug] Auto mode safety check blocks writing skill files